Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3187)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-3187.
##

include('compat.inc');

if (description)
{
  script_id(365283);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-63858",
    "CVE-2026-72493",
    "CVE-2026-80755",
    "CVE-2026-80824",
    "CVE-2026-80830",
    "CVE-2026-80837",
    "CVE-2026-80838",
    "CVE-2026-80840",
    "CVE-2026-80841",
    "CVE-2026-80842",
    "CVE-2026-80843",
    "CVE-2026-80845",
    "CVE-2026-80847",
    "CVE-2026-80852",
    "CVE-2026-80855",
    "CVE-2026-80856",
    "CVE-2026-80857",
    "CVE-2026-80858",
    "CVE-2026-80859",
    "CVE-2026-80860",
    "CVE-2026-80861",
    "CVE-2026-80862",
    "CVE-2026-80920",
    "CVE-2026-80925",
    "CVE-2026-80929",
    "CVE-2026-80932",
    "CVE-2026-80946",
    "CVE-2026-80963",
    "CVE-2026-80976",
    "CVE-2026-80977",
    "CVE-2026-80978",
    "CVE-2026-80994",
    "CVE-2026-81002",
    "CVE-2026-81004",
    "CVE-2026-81005",
    "CVE-2026-81006",
    "CVE-2026-81009",
    "CVE-2026-89448",
    "CVE-2026-89450",
    "CVE-2026-89451",
    "CVE-2026-89453",
    "CVE-2026-89476",
    "CVE-2026-89477",
    "CVE-2026-89478",
    "CVE-2026-89479",
    "CVE-2026-89480",
    "CVE-2026-89481",
    "CVE-2026-89482",
    "CVE-2026-89483",
    "CVE-2026-89484",
    "CVE-2026-89485",
    "CVE-2026-89486",
    "CVE-2026-89487",
    "CVE-2026-89488",
    "CVE-2026-89500",
    "CVE-2026-89501",
    "CVE-2026-89502",
    "CVE-2026-89503",
    "CVE-2026-89507",
    "CVE-2026-89508",
    "CVE-2026-89515",
    "CVE-2026-89520",
    "CVE-2026-89525",
    "CVE-2026-89536",
    "CVE-2026-89538",
    "CVE-2026-89539",
    "CVE-2026-89540",
    "CVE-2026-89541",
    "CVE-2026-89542",
    "CVE-2026-89543",
    "CVE-2026-89544",
    "CVE-2026-89545",
    "CVE-2026-89547",
    "CVE-2026-89548",
    "CVE-2026-89549",
    "CVE-2026-89550",
    "CVE-2026-89551",
    "CVE-2026-89552",
    "CVE-2026-89554",
    "CVE-2026-89555",
    "CVE-2026-89556",
    "CVE-2026-89557",
    "CVE-2026-89558",
    "CVE-2026-89559",
    "CVE-2026-89560",
    "CVE-2026-89561",
    "CVE-2026-89562",
    "CVE-2026-89563",
    "CVE-2026-89564",
    "CVE-2026-89565",
    "CVE-2026-89566",
    "CVE-2026-89567",
    "CVE-2026-89573",
    "CVE-2026-89574",
    "CVE-2026-89575",
    "CVE-2026-89577",
    "CVE-2026-89578",
    "CVE-2026-89579",
    "CVE-2026-89580",
    "CVE-2026-89581",
    "CVE-2026-89586",
    "CVE-2026-89588",
    "CVE-2026-89589",
    "CVE-2026-89593",
    "CVE-2026-89595",
    "CVE-2026-89600",
    "CVE-2026-89602",
    "CVE-2026-89603",
    "CVE-2026-89604",
    "CVE-2026-89615",
    "CVE-2026-89616",
    "CVE-2026-89617",
    "CVE-2026-89618",
    "CVE-2026-89631",
    "CVE-2026-89633",
    "CVE-2026-89634",
    "CVE-2026-89636",
    "CVE-2026-89637",
    "CVE-2026-89638",
    "CVE-2026-89640",
    "CVE-2026-89641",
    "CVE-2026-89643",
    "CVE-2026-89644",
    "CVE-2026-89645",
    "CVE-2026-89646",
    "CVE-2026-89647",
    "CVE-2026-89648",
    "CVE-2026-89649",
    "CVE-2026-89650",
    "CVE-2026-89651",
    "CVE-2026-89652",
    "CVE-2026-89653",
    "CVE-2026-89655",
    "CVE-2026-89656",
    "CVE-2026-89657",
    "CVE-2026-89658",
    "CVE-2026-89659",
    "CVE-2026-89660",
    "CVE-2026-89662",
    "CVE-2026-89663",
    "CVE-2026-89666",
    "CVE-2026-89667",
    "CVE-2026-89668",
    "CVE-2026-89669",
    "CVE-2026-89671",
    "CVE-2026-89675",
    "CVE-2026-89676",
    "CVE-2026-89679",
    "CVE-2026-89680",
    "CVE-2026-89682",
    "CVE-2026-89683",
    "CVE-2026-89684",
    "CVE-2026-89685",
    "CVE-2026-89688",
    "CVE-2026-89689",
    "CVE-2026-89690",
    "CVE-2026-89691",
    "CVE-2026-89692",
    "CVE-2026-89693",
    "CVE-2026-89694",
    "CVE-2026-89696",
    "CVE-2026-89698",
    "CVE-2026-89699",
    "CVE-2026-89700",
    "CVE-2026-89701",
    "CVE-2026-89702",
    "CVE-2026-89703",
    "CVE-2026-89704",
    "CVE-2026-89706",
    "CVE-2026-89707",
    "CVE-2026-89708",
    "CVE-2026-89710",
    "CVE-2026-89711",
    "CVE-2026-89712",
    "CVE-2026-89713",
    "CVE-2026-89714",
    "CVE-2026-89717",
    "CVE-2026-89726",
    "CVE-2026-89741",
    "CVE-2026-89743",
    "CVE-2026-89744",
    "CVE-2026-89747",
    "CVE-2026-89752",
    "CVE-2026-89753",
    "CVE-2026-89754",
    "CVE-2026-89756",
    "CVE-2026-89757",
    "CVE-2026-89763",
    "CVE-2026-89766",
    "CVE-2026-89767",
    "CVE-2026-89768",
    "CVE-2026-89771",
    "CVE-2026-89775",
    "CVE-2026-89799",
    "CVE-2026-89816",
    "CVE-2026-89822",
    "CVE-2026-89823",
    "CVE-2026-89897",
    "CVE-2026-89899",
    "CVE-2026-89911",
    "CVE-2026-89912",
    "CVE-2026-89913",
    "CVE-2026-89914",
    "CVE-2026-89916",
    "CVE-2026-89918",
    "CVE-2026-89927",
    "CVE-2026-89928",
    "CVE-2026-89929",
    "CVE-2026-89930",
    "CVE-2026-89932",
    "CVE-2026-89965",
    "CVE-2026-89973",
    "CVE-2026-89983",
    "CVE-2026-89984",
    "CVE-2026-89986",
    "CVE-2026-89988",
    "CVE-2026-89989",
    "CVE-2026-89990",
    "CVE-2026-89991",
    "CVE-2026-89992",
    "CVE-2026-89995",
    "CVE-2026-89997",
    "CVE-2026-89998",
    "CVE-2026-90011",
    "CVE-2026-90012",
    "CVE-2026-90015",
    "CVE-2026-90036",
    "CVE-2026-90037",
    "CVE-2026-90039",
    "CVE-2026-90042",
    "CVE-2026-90048",
    "CVE-2026-90049",
    "CVE-2026-93205",
    "CVE-2026-93206",
    "CVE-2026-93207",
    "CVE-2026-93210",
    "CVE-2026-93211",
    "CVE-2026-93212",
    "CVE-2026-93213",
    "CVE-2026-93222",
    "CVE-2026-93226",
    "CVE-2026-93227",
    "CVE-2026-93229",
    "CVE-2026-93230",
    "CVE-2026-93231",
    "CVE-2026-93239",
    "CVE-2026-93240",
    "CVE-2026-93241",
    "CVE-2026-93244",
    "CVE-2026-98164"
  );

  script_name(english:"Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3187)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3187 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: add hook transactions for device deletions (CVE-2026-63858)

    In the Linux kernel, the following vulnerability has been resolved:

    net: serialize netif_running() check in enqueue_to_backlog() (CVE-2026-72493)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: reject a permission value exceeding the class permission count (CVE-2026-80755)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: core: Add lock to usb_wakeup_notification() (CVE-2026-80830)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: don't queue packet path object notifications (CVE-2026-80837)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: keep the last remote linked during FDB flush (CVE-2026-80838)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: seg6: clear IPv4 control block on IPIP decapsulation (CVE-2026-80840)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: defer vmalloc TX_RING free until skbs finish (CVE-2026-80841)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (CVE-2026-80842)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix xfrm_state_construct() auth-trunc leak (CVE-2026-80843)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: avoid lock inversion in nat keepalive work (CVE-2026-80845)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: clamp route advmss to TCP_MIN_MSS (CVE-2026-80847)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: device: fix out-of-bounds write in tls_append_frag() (CVE-2026-80852)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: fix invalidate lock leak on open O_TRUNC DAX failure (CVE-2026-80855)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: fix invalidate lock leak on setattr writeback failure (CVE-2026-80856)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free (CVE-2026-80857)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: publish io-uring queues with release semantics (CVE-2026-80858)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: fix missing barrier when checking io-uring readiness (CVE-2026-80859)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: fix race between interrupt and resend (CVE-2026-80860)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: bail out of setup if the controller is inaccessible (CVE-2026-80861)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: fix usage of page_frag_cache (CVE-2026-80862)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: defer eventfd signaling when queued from a wakeup handler (CVE-2026-80920)

    In the Linux kernel, the following vulnerability has been resolved:

    vlan: fix skb_under_panic and races when toggling HW VLAN offload (CVE-2026-80925)

    In the Linux kernel, the following vulnerability has been resolved:

    sysctl: move the cad_pid entry from pid_table[] to kern_reboot_table[] (CVE-2026-80929)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: flush works in dependency order (CVE-2026-80932)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: copy request headers via a stack buffer for io-uring (CVE-2026-80946)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-stats: fix a crash if allocation of per-cpu data fails (CVE-2026-80963)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: reset IP6CB after IPv6 decapsulation (CVE-2026-80976)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skbuff: don't touch shared zerocopy state in skb_tx_error() (CVE-2026-80977)

    In the Linux kernel, the following vulnerability has been resolved:

    net: cap advertised IP tunnel headroom (CVE-2026-80978)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix flow mask use-after-free on flow deletion (CVE-2026-80994)

    In the Linux kernel, the following vulnerability has been resolved:

    xdp: fix zero-copy frame layout (CVE-2026-81002)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi:msghandler: Cancel work cleanly on an error

    If an error occurs during startup of an IPMI interface, it may havescheduled work to run.  The work needs
    to be canceled before theinterface can be freed. (CVE-2026-81004)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi: si: Fix NULL pointer dereference after failed registration (CVE-2026-81005)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi: Remove all sysfs files on registration failure (CVE-2026-81006)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/query: cap user size passed to copy_struct_to_user (CVE-2026-81009)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Force requesting ACS when tboot is enabled (CVE-2026-89448)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field (CVE-2026-89450)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/sva: Set handle->dev before the SVA handle is visible (CVE-2026-89451)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Put PCI device after handling PPR faults (CVE-2026-89453)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix stream->outcnt underflow on duplicate RECONF responses

    A cached RECONF chunk may contain more than one request parameter.  Aduplicate response can therefore find
    and process the same ADD_OUT requestagain while another parameter is still outstanding, rolling back
    outcnttwice and possibly underflowing it.

    Track outstanding request types as bits and clear each bit after its firstresponse.  Later responses for
    the same request are then ignored. (CVE-2026-89476)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix NULL deref on untransmitted RECONF completion (CVE-2026-89477)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: drop a chunk if its transport was removed (CVE-2026-89478)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: reject a read that transferred too few bytes

    nvme_tcp_recv_data() completes a request once the current C2HData PDUhas been consumed. Nothing compares
    the total bytes received againstthe length the command asked for: struct nvme_tcp_request has noreceive-
    side counter, queue->data_remaining is per queue, andblk_mq_end_request() completes for blk_rq_bytes(rq)
    unconditionallywith no residual concept anywhere above.

    A controller can therefore answer a 4096-byte read with 512 bytes andhave it reported as a complete read;
    user space then gets 4096 bytes ofwhich 3584 are whatever was already in the page. I reproduced that witha
    test target.

    Count the bytes received and refuse to complete a successful read whosecount does not match, at the two
    NVME_TCP_F_DATA_SUCCESS paths and innvme_tcp_process_nvme_cqe(). The success test shifts req->status
    rightby one, because the driver keeps the wire value there and shifts it oncompletion, so the check must
    see what the completion path will see.Only REQ_OP_READ is checked, because there the length comes from
    thesectors the request covers; a passthrough command is built by itssubmitter, which picks both command
    and buffer, so the kernel hasnothing to compare against. (CVE-2026-89480)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (CVE-2026-89482)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme: zero the discard fallback page (CVE-2026-89483)

    In the Linux kernel, the following vulnerability has been resolved:

    lockd: fix NULL dereference on lockowner allocation failure (CVE-2026-89484)

    In the Linux kernel, the following vulnerability has been resolved:

    lockd: pin next file across nlm_inspect_file lock-drop (CVE-2026-89485)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() (CVE-2026-89486)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: only skb_tx_error() a packet we are about to drop (CVE-2026-89487)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (CVE-2026-89500)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (CVE-2026-89501)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Free cpu_buffer::free_page with subbuf_order (CVE-2026-89502)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()

    ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set,it can allocate a reader page with
    an outdated order. This isn't a bigissue, the user can still re-allocate a new reader page and try again.

    However, what is more problematic is if the value of subbuf_orderchanges in the middle of
    ring_buffer_alloc_read_page(). In that case,bpage->order might not match the actual allocated memory.

    Use bpage->order for the allocation to prevent this race. (CVE-2026-89503)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/ucma: Lock the handler in ucma_write_cm_event() (CVE-2026-89507)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/ucma: Lock the handler in ucma_set_ib_path() (CVE-2026-89508)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() (CVE-2026-89515)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/core: Make core-sched flips wait for in-flight selections (CVE-2026-89520)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: reject VAT indexes equal to the entry count (CVE-2026-89525)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: wait for in-flight client TLS handshake callback (CVE-2026-89536)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (CVE-2026-89538)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: reject duplicate CREDS_VALUE options (CVE-2026-89539)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: init gssp_lock before publishing proc entry (CVE-2026-89540)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: harden gss_unwrap_resp_priv length checks (CVE-2026-89541)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (CVE-2026-89542)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

    Normal client creation goes through rpc_setup_pipedir(), which recordsclnt->pipefs_sb, but the mount-event
    path in __rpc_clnt_handle_event()calls rpc_setup_pipedir_sb() directly and never refreshes that field.The
    umount path also removes the directory without clearingclnt->pipefs_sb.

    After a late pipefs mount or any remount, rpc_clnt_remove_pipedir()compares the current superblock against
    a stale pipefs_sb pointer andskips cleanup, leaving pipefs dentries whose inode private data stillpoints
    at a freed rpc_clnt, leading to a potential use-after-free duringsubsequent rpc_info_open() or
    rpc_show_info() calls.

    Fix this by properly updating clnt->pipefs_sb upon mount events andclearing it during unmount or failure
    paths. (CVE-2026-89543)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: fix gssx_dec_option_array error path bugs (CVE-2026-89544)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: defer rq_argp and rq_resp free until after RCU grace period (CVE-2026-89545)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Check svc pool percpu counter allocation

    __svc_create() initializes three per-pool percpu_counter stats andignores every return value. On SMP,
    percpu_counter_init() fails when__alloc_percpu_gfp() cannot satisfy the allocation, leaving the
    failedcounter with fbc->counters == NULL and its embedded raw_spinlock_t,list_head, and count never
    initialized. __svc_create() returns thehalf-constructed svc_serv to nfsd, lockd, or the NFS callback
    serviceanyway.

    Once that service is live, the hot-path increments insvc_xprt_enqueue(), svc_handle_xprt(),
    andsvc_pool_wake_idle_thread() reach a counter whose backing pointer isNULL. The pointer is a per-cpu
    offset, so the access does not fault:it resolves to offset zero of the current CPU's per-cpu area
    andsilently corrupts whatever variable lives there. A/proc/fs/nfsd/pool_stats read walks the same NULL
    per-cpu storage andreturns garbage, and on CONFIG_DEBUG_SPINLOCK or lockdep it splats onthe never-
    initialized lock.

    Creating the broken service requires a percpu allocation failure duringRPC server startup, so it is
    reachable only by a local administratorunder memory pressure or fault injection; a remote peer cannot
    inducethe bad state on its own.

    Check each percpu_counter_init() return value in __svc_create() andfail when an allocation fails,
    unwinding the counters already set upin the current pool and in every pool initialized before it.
    Adiscrete percpu_counter_destroy() per counter at teardown frees eachper-cpu allocation exactly once.
    (CVE-2026-89547)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: always drain cache_cleaner before destroying a cache_detail (CVE-2026-89548)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: route to a populated pool in svc_pool_for_cpu() (CVE-2026-89549)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: svcauth_gss: enforce krb5 token minimum length (CVE-2026-89550)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (CVE-2026-89551)

    In the Linux kernel, the following vulnerability has been resolved:

    params: fix charp corruption on allocation failure (CVE-2026-89552)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (CVE-2026-89554)

    In the Linux kernel, the following vulnerability has been resolved:

    mpls: reload header after pskb_may_pull()

    mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthopwhen an MPLS route has multiple
    nexthops.  While walking the MPLS labelstack, the hash routine caches hdr for the current label.  After
    findingthe bottom-of-stack label, it calls pskb_may_pull() before reading theinner IP header.

    If an skb is constructed with the inner IP header in nonlinear data andinsufficient tailroom in the linear
    head, pskb_may_pull() callspskb_expand_head() to replace the skb head and free the old one.  Thisleaves
    hdr pointing to freed memory.  The IPv6 path can invalidate hdragain when it performs a second pull for
    the larger header.

    The issue was found through static analysis.  A reproducer sending a legalGeneve packet through a
    bareudp/MPLS multipath setup triggered the sameKASAN report in 2 of 2 unpatched runs:

    BUG: KASAN: slab-use-after-free in mpls_select_multipathRead of size 1 at addr ffff88800ecc6e20 by task
    ksoftirqd/1/23

    Call Trace:mpls_select_multipathmpls_forward__netif_receive_skb_list_corenetif_receive_skb_list_internalna
    pi_complete_donegro_cell_poll__napi_pollnet_rx_action

    Freed by task 23:kfreepskb_expand_head__pskb_pull_tailmpls_select_multipath

    Reload hdr from the current skb head after each successful pull beforederiving the inner IPv4 or IPv6
    header pointer. (CVE-2026-89555)

    In the Linux kernel, the following vulnerability has been resolved:

    module: validate string table section types (CVE-2026-89556)

    In the Linux kernel, the following vulnerability has been resolved:

    md: do overflow check for sb->bblog_shift in super_1_load() (CVE-2026-89557)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix still_degraded being inverted in raid10_sync_request() (CVE-2026-89558)

    In the Linux kernel, the following vulnerability has been resolved:

    libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (CVE-2026-89559)

    In the Linux kernel, the following vulnerability has been resolved:

    landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation

    Whiteout objects are used in the upper layer of an OverlayFS toindicate that the file with this name does
    not exist in the unifiedview, even if it is present in one of the lower layer file systems.

    For the userspace implementations of OverlayFS (fuse-overlayfs),whiteout objects can be created from
    userspace as well:

    * mknod(2) with S_IFCHR and makedev(0, 0)* renameat2(2) with RENAME_WHITEOUT,creating the whiteout in the
    old place of the moved file.

    This commit guards whiteout creation in both of these cases withLANDLOCK_ACCESS_FS_MAKE_REG.  Whiteout
    objects are *not* consideredcharacter devices and are not bound to a driver.

    LANDLOCK_ACCESS_FS_MAKE_REG describes the same permission class as awhiteout object: creating one is the
    only S_IFCHR creation that the VFSexempts from CAP_MKNOD, so it is as unprivileged as creating a
    regularfile, while LANDLOCK_ACCESS_FS_MAKE_CHAR andLANDLOCK_ACCESS_FS_MAKE_BLOCK keep meaning the creation
    of devices thatexpose a kernel interface [1].

    For the mknod(2) case, introduce a Landlock erratum.  The creation ofwhiteout objects through mknod(2) was
    previously guarded usingLANDLOCK_ACCESS_FS_MAKE_CHAR, and it is now guarded
    usingLANDLOCK_ACCESS_FS_MAKE_REG.

    For the renameat2(2) case, fix a bug: Before this commit, renameat2(2)with RENAME_WHITEOUT would create a
    directory entry even when allLANDLOCK_ACCESS_FS_MAKE_* rights were denied.

    This does not affect normal renames within layered OverlayFS mounts:When doing a regular rename() on a
    mounted fuse-overlayfs, it is thefuse-overlayfs daemon that exercises renameat2() with RENAME_WHITEOUT,and
    only the Landlock domain of that daemon is checked there.

    Depends-on: 49c9e09d9610 (landlock: Fix handling of disconnected directories)Depends-on: fe72ce6710cb
    (landlock: Add errata documentation section)[mic: Record why LANDLOCK_ACCESS_FS_MAKE_REG is the matching
    right, andadd link(2) to the user doc] (CVE-2026-89560)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() (CVE-2026-89561)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_gre: fix hardware header length for NBMA tunnels (CVE-2026-89562)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() (CVE-2026-89563)

    In the Linux kernel, the following vulnerability has been resolved:

    ip: orphan prefetched skbs before multicast forwarding (CVE-2026-89564)

    In the Linux kernel, the following vulnerability has been resolved:

    ipip: fix skb leak in collect_md mode when metadata_dst allocation fails (CVE-2026-89565)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: check need_resched() when skipping busy checkpoint buffers (CVE-2026-89566)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: bound shrinker scans by examined checkpoint buffers (CVE-2026-89567)

    In the Linux kernel, the following vulnerability has been resolved:

    dm array: reject an array block whose value size is not the caller's (CVE-2026-89573)

    In the Linux kernel, the following vulnerability has been resolved:

    dm array: validate array block headers on read (CVE-2026-89574)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid1: reserve space for NUL-terminator in build_constructor_string() (CVE-2026-89575)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-io: report non-retryable errors separatedly (CVE-2026-89577)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-io: clone the source bio instead of copying its biovec (CVE-2026-89578)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Harden bloom filter sizing and indexing on 32-bit kernels (CVE-2026-89579)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Disable preemption in __bpf_get_stack (CVE-2026-89580)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, x86: Fix per-CPU address resolution into an extended register (CVE-2026-89581)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes (CVE-2026-89586)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: APEI: GHES: fix ARM section length accounting after header (CVE-2026-89588)

    In the Linux kernel, the following vulnerability has been resolved:

    acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks (CVE-2026-89589)

    In the Linux kernel, the following vulnerability has been resolved:

    hugetlb: only adjust reservation during unmapping if mapcount is 0

    Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations.  Inthe case of folio mapped in both a
    parent and a child, if the parentunmaps the range first, the reservation adjustment will result in
    anunderflow of the reserved count.  Once the child unmaps the range, thecount is restored.  Change
    __unmap_hugepage_range() to check the mapcountbefore adjusting the reservation. (CVE-2026-89593)

    In the Linux kernel, the following vulnerability has been resolved:

    fsnotify: Fix stale object mask after concurrent mark updates (CVE-2026-89595)

    In the Linux kernel, the following vulnerability has been resolved:

    fanotify: fix use-after-free of file range info (CVE-2026-89600)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: skip sufficiently large global buffers when resizing (CVE-2026-89602)

    In the Linux kernel, the following vulnerability has been resolved:

    entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: Rate limit statfs() handler (CVE-2026-89604)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: bound page_lcns[] index by the log record (CVE-2026-89615)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() (CVE-2026-89616)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate dirty page table on log replay (CVE-2026-89617)

    In the Linux kernel, the following vulnerability has been resolved:

    eventfs: Initialize ei->children and ei->list in init_ei() (CVE-2026-89618)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix ALIGN() overflow in symlink_data() error context loop (CVE-2026-89634)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: clear ce->tgthint in free_tgts() (CVE-2026-89636)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 (CVE-2026-89637)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (CVE-2026-89640)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (CVE-2026-89641)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: avoid dropping live tree ref on fsnotify rule autoremove

    audit_del_rule() is used for both netlink deletion templates and internalfsnotify autoremove.  The former
    passes a parsed template which owns atemporary tree reference; the latter passes the installed entry
    itself.

    The unconditional audit_put_tree() at the end of audit_del_rule() assumesthe template case.  For mixed
    AUDIT_DIR plus AUDIT_EXE rules, an fsnotifyautoremove event therefore drops the installed rule's live tree
    reference.Repeating this across rules sharing the same tree can free the tree whileanother rule still
    references it, and a later autoremove dereferences thefreed pathname while comparing rules.

    Move the temporary-tree put to audit_rule_change(), the caller that ownsdeletion templates.  Keep it in
    the AUDIT_DEL_RULE cleanup so bothsuccessful deletion and -ENOENT still release the parser-owned tree.
    (CVE-2026-89643)

    In the Linux  ...

  Please note that the description has been truncated due to length. Please refer to vendor advisory for the full
description.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-3187.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63858.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-72493.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80755.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80824.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80830.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80837.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80838.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80840.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80841.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80842.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80843.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80845.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80847.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80852.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80855.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80856.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80857.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80858.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80859.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80860.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80861.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80862.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80920.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80925.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80929.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80932.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80946.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80963.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80976.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80977.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80978.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80994.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-81002.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-81004.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-81005.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-81006.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-81009.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89448.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89450.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89451.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89453.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89476.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89477.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89478.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89479.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89480.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89481.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89482.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89483.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89484.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89485.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89486.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89487.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89488.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89500.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89501.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89502.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89503.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89507.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89508.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89515.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89520.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89525.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89536.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89538.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89539.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89540.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89541.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89542.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89543.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89544.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89545.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89547.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89548.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89549.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89550.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89551.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89552.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89554.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89555.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89556.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89557.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89558.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89559.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89560.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89561.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89562.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89563.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89564.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89565.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89566.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89567.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89573.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89574.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89575.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89577.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89578.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89579.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89580.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89581.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89586.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89588.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89589.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89593.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89595.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89600.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89602.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89603.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89604.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89615.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89616.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89617.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89618.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89631.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89633.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89634.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89636.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89637.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89638.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89640.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89641.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89643.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89644.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89645.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89646.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89647.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89648.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89649.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89650.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89651.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89652.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89653.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89655.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89656.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89657.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89658.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89659.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89660.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89662.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89663.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89666.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89667.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89668.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89669.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89671.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89675.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89676.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89679.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89680.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89682.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89683.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89684.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89685.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89688.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89689.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89690.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89691.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89692.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89693.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89694.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89696.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89698.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89699.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89700.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89701.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89702.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89703.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89704.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89706.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89707.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89708.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89710.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89711.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89712.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89713.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89714.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89717.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89726.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89741.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89743.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89744.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89747.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89752.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89753.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89754.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89756.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89757.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89763.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89766.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89767.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89768.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89771.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89775.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89799.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89816.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89822.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89823.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89897.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89899.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89911.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89912.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89913.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89914.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89916.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89918.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89927.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89928.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89929.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89930.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89932.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89965.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89973.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89983.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89984.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89986.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89988.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89989.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89990.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89991.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89992.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89995.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89997.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89998.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90011.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90012.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90015.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90036.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90037.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90039.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90042.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90048.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90049.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93205.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93206.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93207.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93210.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93211.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93212.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93213.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93222.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93226.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93227.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93229.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93230.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93231.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93239.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93240.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93241.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93244.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-98164.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update kernel6.18 --releasever 2023.12.20261012' or
  or 'dnf update --advisory ALAS2023-2026-3187 --releasever 2023.12.20261012' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-98164");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:bpftool6.18");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:bpftool6.18-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-livepatch-6.18.51-120.162");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.18");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.18-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.18-debuginfo-common-aarch64");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.18-debuginfo-common-x86_64");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.18-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.18-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.18-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.18-modules-extra-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.18-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.18-tools-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.18-tools-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:microvm-kernel6.18");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perf6.18");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perf6.18-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3-perf6.18");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3-perf6.18-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'bpftool6.18-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool6.18-6.18.'},
    {'reference':'bpftool6.18-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool6.18-6.18.'},
    {'reference':'bpftool6.18-debuginfo-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool6.18-debuginfo-6.18.'},
    {'reference':'bpftool6.18-debuginfo-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool6.18-debuginfo-6.18.'},
    {'reference':'kernel-livepatch-6.18.51-120.162-1.0-0.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'kernel-livepatch-6.18.51-120.162-1.0-0.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'kernel6.18-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-6.18.'},
    {'reference':'kernel6.18-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-6.18.'},
    {'reference':'kernel6.18-debuginfo-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-debuginfo-6.18.'},
    {'reference':'kernel6.18-debuginfo-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-debuginfo-6.18.'},
    {'reference':'kernel6.18-debuginfo-common-aarch64-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-debuginfo-common-aarch64-6.18.'},
    {'reference':'kernel6.18-debuginfo-common-x86_64-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-debuginfo-common-x86_64-6.18.'},
    {'reference':'kernel6.18-devel-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-devel-6.18.'},
    {'reference':'kernel6.18-devel-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-devel-6.18.'},
    {'reference':'kernel6.18-headers-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-headers-6.18.'},
    {'reference':'kernel6.18-headers-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-headers-6.18.'},
    {'reference':'kernel6.18-modules-extra-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-modules-extra-6.18.'},
    {'reference':'kernel6.18-modules-extra-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-modules-extra-6.18.'},
    {'reference':'kernel6.18-modules-extra-common-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-modules-extra-common-6.18.'},
    {'reference':'kernel6.18-modules-extra-common-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-modules-extra-common-6.18.'},
    {'reference':'kernel6.18-tools-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-tools-6.18.'},
    {'reference':'kernel6.18-tools-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-tools-6.18.'},
    {'reference':'kernel6.18-tools-debuginfo-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-tools-debuginfo-6.18.'},
    {'reference':'kernel6.18-tools-debuginfo-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-tools-debuginfo-6.18.'},
    {'reference':'kernel6.18-tools-devel-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-tools-devel-6.18.'},
    {'reference':'kernel6.18-tools-devel-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.18-tools-devel-6.18.'},
    {'reference':'microvm-kernel6.18-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'microvm-kernel6.18-6.18.'},
    {'reference':'microvm-kernel6.18-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'microvm-kernel6.18-6.18.'},
    {'reference':'perf6.18-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf6.18-6.18.'},
    {'reference':'perf6.18-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf6.18-6.18.'},
    {'reference':'perf6.18-debuginfo-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf6.18-debuginfo-6.18.'},
    {'reference':'perf6.18-debuginfo-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf6.18-debuginfo-6.18.'},
    {'reference':'python3-perf6.18-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf6.18-6.18.'},
    {'reference':'python3-perf6.18-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf6.18-6.18.'},
    {'reference':'python3-perf6.18-debuginfo-6.18.51-120.162.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf6.18-debuginfo-6.18.'},
    {'reference':'python3-perf6.18-debuginfo-6.18.51-120.162.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf6.18-debuginfo-6.18.'}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "bpftool6.18 / bpftool6.18-debuginfo / kernel-livepatch-6.18.51-120.162 / etc");
}